formatdecenc: fix crash in MJPEG decoder; add fuzz tests

This commit is contained in:
aler9
2023-01-07 16:43:45 +01:00
parent 441a90a519
commit 0499d99e83
46 changed files with 232 additions and 582 deletions

View File

@@ -452,165 +452,12 @@ func TestDecodeUntilMarker(t *testing.T) {
require.Equal(t, [][]byte{{0x01, 0x02}, {0x01, 0x02}}, nalus) require.Equal(t, [][]byte{{0x01, 0x02}, {0x01, 0x02}}, nalus)
} }
func TestDecodeErrors(t *testing.T) { func FuzzDecoderUnmarshal(f *testing.F) {
for _, ca := range []struct { d := &Decoder{}
name string d.Init()
pkts []*rtp.Packet
err string f.Fuzz(func(t *testing.T, b []byte) {
}{ d.Decode(&rtp.Packet{
{
"missing payload",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
},
},
"payload is too short",
},
{
"STAP-A without NALUs",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x18},
},
},
"STAP-A packet doesn't contain any NALU",
},
{
"STAP-A without size",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x18, 0x01},
},
},
"invalid STAP-A packet (invalid size)",
},
{
"STAP-A with invalid size",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x18, 0x00, 0x15},
},
},
"invalid STAP-A packet (invalid size)",
},
{
"FU-A without payload",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x1c},
},
},
"invalid FU-A packet (invalid size)",
},
{
"FU-A with start and end bit",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17646,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x1c, 0b11000000},
},
},
"invalid FU-A packet (can't contain both a start and end bit)",
},
{
"FU-A non-starting 1",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17646,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x1c, 0b01000000},
},
},
"received a non-starting fragment without any previous starting fragment",
},
{
"FU-A non-starting 2",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: mergeBytes(
[]byte{0x05},
bytes.Repeat([]byte{0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07}, 8),
),
},
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17646,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x1c, 0b01000000},
},
},
"invalid FU-A packet (non-starting)",
},
{
"MTAP",
[]*rtp.Packet{
{
Header: rtp.Header{ Header: rtp.Header{
Version: 2, Version: 2,
Marker: false, Marker: false,
@@ -619,21 +466,7 @@ func TestDecodeErrors(t *testing.T) {
Timestamp: 2289527317, Timestamp: 2289527317,
SSRC: 0x9dbb7812, SSRC: 0x9dbb7812,
}, },
Payload: []byte{0x1a}, Payload: b,
}, })
},
"packet type not supported (MTAP-16)",
},
} {
t.Run(ca.name, func(t *testing.T) {
d := &Decoder{}
d.Init()
var lastErr error
for _, pkt := range ca.pkts {
_, _, lastErr = d.Decode(pkt)
}
require.EqualError(t, lastErr, ca.err)
}) })
}
} }

View File

@@ -0,0 +1,2 @@
go test fuzz v1
[]byte("\x1c\xd4")

View File

@@ -0,0 +1,2 @@
go test fuzz v1
[]byte("\x1c")

View File

@@ -0,0 +1,2 @@
go test fuzz v1
[]byte("\x1c0")

View File

@@ -174,185 +174,21 @@ func TestDecode(t *testing.T) {
} }
} }
func TestDecodeErrors(t *testing.T) { func FuzzDecoderUnmarshal(f *testing.F) {
for _, ca := range []struct {
name string
pkts []*rtp.Packet
err string
}{
{
"missing payload",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
},
},
"payload is too short",
},
{
"aggregation unit no size",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{48 << 1, 0x00, 0x01},
},
},
"invalid aggregation unit (invalid size)",
},
{
"aggregation unit invalid size",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{48 << 1, 0x00, 0x00, 0x05, 0x00},
},
},
"invalid aggregation unit (invalid size)",
},
{
"aggregation unit no NALUs",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{48 << 1, 0x00, 0x00, 0x00},
},
},
"aggregation unit doesn't contain any NALU",
},
{
"fragmentation unit invalid",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{49 << 1, 0x00},
},
},
"payload is too short",
},
{
"fragmentation unit start and end bit",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{49 << 1, 0x00, 0b11000000},
},
},
"invalid fragmentation unit (can't contain both a start and end bit)",
},
{
"fragmentation unit non-starting 1",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{49 << 1, 0x00, 0b01000000},
},
},
"received a non-starting fragment without any previous starting fragment",
},
{
"fragmentation unit non-starting 2",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x01, 0x00},
},
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{49 << 1, 0x00, 0b00000000},
},
},
"invalid fragmentation unit (non-starting)",
},
{
"paci",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: []byte{50 << 1, 0x00},
},
},
"PACI packets are not supported (yet)",
},
} {
t.Run(ca.name, func(t *testing.T) {
d := &Decoder{} d := &Decoder{}
d.Init() d.Init()
var lastErr error f.Fuzz(func(t *testing.T, b []byte) {
for _, pkt := range ca.pkts { d.Decode(&rtp.Packet{
_, _, lastErr = d.Decode(pkt) Header: rtp.Header{
} Version: 2,
require.EqualError(t, lastErr, ca.err) Marker: false,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: b,
})
}) })
}
} }

View File

@@ -0,0 +1,2 @@
go test fuzz v1
[]byte("a000")

View File

@@ -0,0 +1,2 @@
go test fuzz v1
[]byte("bbbbbbbbbbbbb0")

View File

@@ -0,0 +1,2 @@
go test fuzz v1
[]byte("b0\xcd")

View File

@@ -106,3 +106,26 @@ func TestDecode(t *testing.T) {
}) })
} }
} }
func FuzzDecoderUnmarshal(f *testing.F) {
d := &Decoder{
BitDepth: 24,
SampleRate: 48000,
ChannelCount: 2,
}
d.Init()
f.Fuzz(func(t *testing.T, b []byte) {
d.Decode(&rtp.Packet{
Header: rtp.Header{
Version: 2,
Marker: false,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: b,
})
})
}

View File

@@ -167,6 +167,10 @@ func (d *Decoder) Decode(pkt *rtp.Packet) ([]byte, time.Duration, error) {
return nil, 0, ErrMorePacketsNeeded return nil, 0, ErrMorePacketsNeeded
} }
if d.fragmentedSize < 2 {
return nil, 0, fmt.Errorf("invalid data")
}
data := make([]byte, d.fragmentedSize) data := make([]byte, d.fragmentedSize)
pos := 0 pos := 0

View File

@@ -527,3 +527,22 @@ func TestDecode(t *testing.T) {
}) })
} }
} }
func FuzzDecoderUnmarshal(f *testing.F) {
d := &Decoder{}
d.Init()
f.Fuzz(func(t *testing.T, b []byte, m bool) {
d.Decode(&rtp.Packet{
Header: rtp.Header{
Version: 2,
Marker: m,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: b,
})
})
}

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("0")
bool(false)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("0\x00\x00\x00\x01\xff000\x00\x00@0000000000000000000000000000000000000000000000000000000000000000")
bool(true)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("0000\x01\xff00000000000000000000000000000000000000000000000000000000000000000000000")
bool(true)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("0000\x01\xff00")
bool(false)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("0\x00\x00\x00\x01\xff00")
bool(false)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("0000\x01\xff00000000000000000000000000000000000000000000000000000000000000000000000")
bool(false)

View File

@@ -579,226 +579,26 @@ func TestDecodeADTS(t *testing.T) {
} }
} }
func TestDecodeErrors(t *testing.T) { func FuzzDecoderUnmarshal(f *testing.F) {
for _, ca := range []struct {
name string
pkts []*rtp.Packet
err string
}{
{
"missing payload",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 0x60,
SequenceNumber: 0x44ed,
Timestamp: 0x88776a15,
SSRC: 0x9dbb7812,
},
},
},
"payload is too short",
},
{
"missing au header",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 0x60,
SequenceNumber: 0x44ed,
Timestamp: 0x88776a15,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x00, 0x10},
},
},
"not enough bits",
},
{
"missing au",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 0x60,
SequenceNumber: 0x44ed,
Timestamp: 0x88776a15,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x00, 0x10, 0x0a, 0xd8},
},
},
"payload is too short",
},
{
"invalid au headers length",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 0x60,
SequenceNumber: 0x44ed,
Timestamp: 0x88776a15,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x00, 0x00},
},
},
"invalid AU-headers-length",
},
{
"au index not zero",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 0x60,
SequenceNumber: 0x44ed,
Timestamp: 0x88776a15,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x00, 0x10, 0x0a, 0xd9},
},
},
"AU-index different than zero is not supported",
},
{
"au index delta not zero",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 0x60,
SequenceNumber: 0x44ed,
Timestamp: 0x88776a15,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x00, 0x20, 0x00, 0x08, 0x0a, 0xd9},
},
},
"AU-index-delta different than zero is not supported",
},
{
"fragmented with multiple AUs in 1st packet",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: false,
PayloadType: 0x60,
SequenceNumber: 0xea2,
Timestamp: 0x88776a15,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x00, 0x20, 0x00, 0x08, 0x00, 0x08},
},
},
"a fragmented packet can only contain one AU",
},
{
"fragmented with no payload in 1st packet",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: false,
PayloadType: 0x60,
SequenceNumber: 0x44ed,
Timestamp: 0x88776a15,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x00, 0x10, 0x0a, 0xd8},
},
},
"payload is too short",
},
{
"fragmented with multiple AUs in 2nd packet",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: false,
PayloadType: 0x60,
SequenceNumber: 0x44ed,
Timestamp: 0x88776a15,
SSRC: 0x9dbb7812,
},
Payload: mergeBytes(
[]byte{0x0, 0x10, 0x2d, 0x80},
bytes.Repeat([]byte{0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07}, 182),
),
},
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 0x60,
SequenceNumber: 0x44ee,
Timestamp: 0x88776a15,
SSRC: 0x9dbb7812,
},
Payload: mergeBytes(
[]byte{0x0, 0x20, 0x00, 0x08, 0x00, 0x08},
),
},
},
"a fragmented packet can only contain one AU",
},
{
"fragmented with no payload in 2nd packet",
[]*rtp.Packet{
{
Header: rtp.Header{
Version: 2,
Marker: false,
PayloadType: 0x60,
SequenceNumber: 0x44ed,
Timestamp: 0x88776a15,
SSRC: 0x9dbb7812,
},
Payload: mergeBytes(
[]byte{0x0, 0x10, 0x2d, 0x80},
bytes.Repeat([]byte{0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07}, 182),
),
},
{
Header: rtp.Header{
Version: 2,
Marker: true,
PayloadType: 0x60,
SequenceNumber: 0x44ee,
Timestamp: 0x88776a15,
SSRC: 0x9dbb7812,
},
Payload: []byte{0x00, 0x10, 0x0a, 0xd8},
},
},
"payload is too short",
},
} {
t.Run(ca.name, func(t *testing.T) {
d := &Decoder{ d := &Decoder{
SampleRate: 48000, SampleRate: 16000,
SizeLength: 13, SizeLength: 13,
IndexLength: 3, IndexLength: 3,
IndexDeltaLength: 3, IndexDeltaLength: 3,
} }
d.Init() d.Init()
var lastErr error f.Fuzz(func(t *testing.T, b []byte, m bool) {
for _, pkt := range ca.pkts { d.Decode(&rtp.Packet{
_, _, lastErr = d.Decode(pkt) Header: rtp.Header{
} Version: 2,
require.EqualError(t, lastErr, ca.err) Marker: m,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: b,
})
}) })
}
} }

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("\x00\x0100")
bool(false)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("000001")
bool(false)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("\x000000000")
bool(true)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("\x00\x00")
bool(true)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("0")
bool(false)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("0001")
bool(true)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("00")
bool(true)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("\x00\x0100")
bool(true)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("\x00\x10\x80\x00")
bool(false)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("\x000000000")
bool(false)

View File

@@ -131,3 +131,22 @@ func TestDecode(t *testing.T) {
}) })
} }
} }
func FuzzDecoderUnmarshal(f *testing.F) {
d := &Decoder{}
d.Init()
f.Fuzz(func(t *testing.T, b []byte, m bool) {
d.Decode(&rtp.Packet{
Header: rtp.Header{
Version: 2,
Marker: m,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: b,
})
})
}

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("0")
bool(false)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte(" 000")
bool(false)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("1000")
bool(false)

View File

@@ -132,3 +132,22 @@ func TestDecode(t *testing.T) {
}) })
} }
} }
func FuzzDecoderUnmarshal(f *testing.F) {
d := &Decoder{}
d.Init()
f.Fuzz(func(t *testing.T, b []byte, m bool) {
d.Decode(&rtp.Packet{
Header: rtp.Header{
Version: 2,
Marker: m,
PayloadType: 96,
SequenceNumber: 17645,
Timestamp: 2289527317,
SSRC: 0x9dbb7812,
},
Payload: b,
})
})
}

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("")
bool(true)

View File

@@ -0,0 +1,3 @@
go test fuzz v1
[]byte("00")
bool(false)